NetSight
IP …
high7.5Public exploit code

CVE-2008-6508

Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication …

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin interface via a .. (dot dot) in a URI that matches the Exclude-Strings list, as demonstrated by a /setup/setup-/.. sequence in a URI.

Affected products

VendorProductAffected versions
IgniterealtimeOpenfire
through 3.6.0a
Versions 2.6.0, 2.6.1, 2.6.2, 3.0.0, 3.0.1

Weakness classification

CWE-22

References